[HIGH PRIORITY] JFrog Artifactory Docker Cache Path Escape (CVE-2026-66384)

⚠ HIGH PRIORITY — CISA KEV (Aug 27, 2026). CVE-2026-66384 is a path traversal flaw in self-hosted JFrog Artifactory. Authenticated users write data outside the intended Docker cache directory under specific remote-repository conditions — potentially planting malicious artifacts on Linux CI/CD hosts.

Affected Artifactory

• Artifactory before 7.146.35
• Artifactory 7.161.0 through 7.161.16 (fix: 7.161.16)
• Self-managed (self-hosted) instances — JFrog Cloud already patched
• Docker remote repositories with cache enabled

Check version

curl -s -u admin:pass http://localhost:8082/artifactory/api/system/version
grep artifactory.product.version $JFROG_HOME/artifactory/var/etc/artifactory.system.properties

Patching Method

1. Upgrade self-hosted Artifactory to 7.161.16 or 7.146.35+.
2. Download patch from JFrog security advisories (released Aug 2026).
3. Schedule maintenance — backup Artifactory DB and filestore first.
4. Apply rolling upgrade per JFrog documentation; verify version via REST API.
5. Audit Docker cache and remote repo paths for unexpected files.
6. Rotate Artifactory admin, service, and CI pipeline tokens.
7. Review access logs for authenticated users writing outside cache paths.

curl -s http://localhost:8082/artifactory/api/system/version
find $JFROG_HOME/artifactory/var/data/filestore -mtime -7 -type f | head

Until patched

• Restrict Artifactory admin and write access to trusted CI accounts
• Disable Docker remote repos if not business-critical
• Segment Artifactory from production Kubernetes clusters

CVSS: Medium (authenticated). Federal deadline: 10 Sep 2026.